We build on the poisoning adversary introduced in Jagielski et al. [1]}. By adversarially constructing two datasets \(D\)  and \(D^{\prime }\)  we can audit DP-SGD.
Concretely, we instantiate the hypothetical differential privacy adversary
under various adversary scenarios
by providing a pair of concrete attack algorithms: one that constructs the two datasets \(D\)  and \(D^{\prime }\) 
differing in one example, and another that receives a model as input (that was trained on
one of these two datasets) and predicts which one it was trained on.
